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What Is Claimed Is: 

1 1. A fault tolerant processing circuit 

2 comprising: 

3 at least three processor groupings each of 

4 said at least three processor groupings having a 

5 plurality of processor grouping inputs and a 

6 plurality of processor grouping outputs; 

7 a processor system clock coupled to the 
4; 8 fault tolerant processing circuit; 

yg 9 a synchronizing circuit comprising a 

10 plurality of output synchronizers, each output 

^ 11 synchronizer in operative communication with a 

J*?; 12 corresponding respective processor grouping for 

].~ 13 synchronizing the output of each processor grouping; 

O 14 a logic circuit in operative communication 

5*=! 15 with said synchronizing circuit, said logic circuit 

M= 16 comprising a fault detection circuit and a fault mask 

17 circuit, said logic circuit adapted to compare said 

18 plurality of processor group outputs to detect errors 

19 in any one of said plurality of processor group 
2 0 outputs; and 

21 a control logic circuit for resetting each 

22 of said at least three processor groups when none of 

23 said at least three processor groups is in a majority 

24 of said processor groups, wherein said fault mask 

25 circuit is adapted to mask the output of a respective 

26 processor grouping associated with a detected error 

27 and signal a detected error. 
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1 2. A fault tolerant processing system 

2 according to claim 1 wherein said synchronizing 

3 circuit further comprises continuously active 

4 synchronization signals. 

1 3 . A fault tolerant processing system 

2 according to claim 1 wherein said synchronizing 

3 circuit further comprises periodically active 

4 synchronization signals. 

1 4 . A fault tolerant processing system 

m 2 according to claim 1 wherein said synchronizing 

^=f 3 circuit further comprises asynchronous signals. 

■y 1 5. A fault tolerant processing system 

g 2 according to claim 1 wherein said synchronizing 

jS 3 circuit further comprises logic operative to 

^ 4 synchronize a JTAG TCLK with said processor system 

Q 5 clock. 

1 6 . A fault tolerant processing system 

2 according to claim 1 wherein an expected rate of 

3 transient faults is tuned by a latent fault scrubbing 

4 rate. 

1 7. A fault tolerant processing system 

2 according to claim 1 wherein each of said at least 

3 three processor groupings comprises: 

4 a central processing unit (CPU) , having an 

5 operating step executed during a clock cycle and 

6 operating synchronously with each other CPU, each 
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7 operating step of each CPU being accomplished in 

8 parallel and substantially simultaneously with each 

9 of the other at least three CPUs each clock cycle, 

10 each of said at least three CPUs having a plurality 

11 of CPU inputs and a plurality of CPU outputs; and 

12 a respective support logic device coupled 

13 to said plurality of CPU inputs and said plurality of 

14 CPU outputs and having a plurality of support logic 

15 device inputs and outputs coupled to said respective 
O 16 CPU. 

•-ft 

On 1 8. A fault tolerant processing system 

H 2 according to claim 1, wherein said logic circuit 

Ijl 3 resets each of said at least three processor groups 

Iy 4 upon detected a fault and, in response, each of said 

p 5 at least three processor groups restart at a hardware 

6 defined operating step. 

ru 

O 1 9. A fault tolerant processing system 

2 according to claim 8, wherein said logic circuit 

3 interrupts said at least three processor groups when 

4 one of said processor groups has a fault, whereby 

5 each of said at least three processor groups without 

6 detected faults store state information and said 

7 logic circuit resets each of said at least three 

8 processor groups after said state information is 

9 stored to restart said at least three processor 
10 groups at a state defined operating step. 

1 10. A fault tolerant processing system 

2 according to claim 8, wherein said logic circuit 
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interrupts said at least three processor groups when 
a minority of said processor groups has a fault, and 
wherein each of said at least three processor groups 
without an error stores state information and said 
logic circuit resets each" of said at least three 
processor groups after said state information is 
stored to restart said at least three processor 
groups at a state defined operating step. 

11. A fault tolerant processing system 
according to claim 9, wherein said logic circuit 
includes fault control and status registers for 
storing said state information. 

12. A fault tolerant processing system 
according to claim 1 , wherein each of said at least 
three support logic devices includes a memory system. 

13. A satellite system comprising: 
a ground station; 

a satellite in operative communication with said 
ground station, said satellite including a fault 
tolerant processing circuit comprising: 

at least three processor groupings each of 
said at least three processor groupings having a 
plurality of processor grouping inputs and a 
plurality of processor grouping outputs ; 

a synchronizing circuit comprising a 
plurality of output synchronizers, each output 
synchronizer in operative communication with a 


# 
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corresponding respective processor grouping for 
synchronizing the output of each processor grouping; 

a fault logic circuit in operative 
communication with said synchronizing circuit, said 
fault logic circuit comprising a fault detection 
circuit and a fault mask circuit, said fault logic 
circuit adapted to compare said plurality of 
processor group outputs to detect errors in any one 
of said plurality of processor group outputs; 

a control logic circuit for resetting each 
of said at least three processor groups when none of 
said at least three processor groups is in a majority 
of said processor groups, wherein said fault mask 
circuit is adapted to mask the output of a respective 
processor grouping associated with a detected error 
and signal a detected error; and 

a system bus coupled to each of said 
plurality of processor group inputs and said fault 
logic circuit output. 

14. A fault tolerant processing system 
according to claim 13 wherein said synchronizing 
circuit further comprises continuously active 
synchronization signals . 

15. A fault tolerant processing system 
according to claim 13 wherein said synchronizing 
circuit further comprises periodically active 
synchronization signals. 
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1 16. A fault tolerant processing system 

2 according to claim 13 wherein said synchronizing 

3 circuit further comprises asynchronous signals. 

1 17. A fault tolerant processing system 

2 according to claim 13 wherein said synchronizing 

3 circuit further comprises logic operative to 

4 synchronize a JTAG TCLK with said processor system 

5 clock. 

1 18. A fault tolerant processing system 

2 according to claim 13 wherein an expected rate of 

3 transient faults is tuned by said latent fault 


y= 4 scrubbing rate. 


O 1 19. A satellite system according to claim 

ID 


2 13 wherein each of said at least three processor 


3 groupings comprises: 

4 a central processing unit, having an 

5 operating step executed during a clock cycle and 

6 operating synchronously with each other CPU, each 

7 operating step of each CPU being accomplished in 

8 parallel and substantially simultaneously with each 

9 of the other at least three CPUs each clock cycle, 

10 each of said at least three CPUs having a plurality 

11 of CPU inputs and a plurality of CPU outputs; and 

12 a respective support logic device coupled 

13 to said plurality of CPU inputs and said plurality of 

14 CPU outputs and having a plurality of support logic 

15 device inputs and outputs coupled to said respective 

16 CPU. 
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1 20. A satellite system according to claim 

2 13, wherein said fault logic circuit resets each of 

3 said at least three processor groups upon detected a 

4 fault and, in response, each of said at least three 

5 processor groups restart at a hardware defined 

6 operating step. 

1 21. A satellite system according to claim 

r=i 2 15, wherein said fault logic circuit interrupts said 

L I3 3 at least three processor groups when one of said 

*5 4 processor groups has a fault, whereby each of said at 

O 5 least three processor groups without detected faults 

l n 6 store state information and said fault logic circuit 

FU 7 resets each of said at least three processor groups 

8 after said state information is stored to restart 
O ■ ■ 

yp 9 said at least three processor groups at a state 

10 defined operating step. 

1 22. A satellite system according to claim 

2 15, wherein said fault logic circuit interrupts said 

3 at least three processor groups when a minority of 

4 said processor groups has a fault, and wherein each 

5 of said at least three processor groups without an 

6 error stores state information and said fault logic 

7 circuit resets each of said at least three processor 

8 groups after said state information is stored to 

9 restart said at least three processor groups at a 
10 state defined operating step. 
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1 23. A satellite system according to claim 

2 21, wherein said fault logic circuit includes fault 

3 control and status registers for storing said state 

4 information. 

1 24 . A satellite system according to claim 

2 13, wherein each of said at least three support logic 

3 devices includes a memory system. 

f=l 1 25. A method of masking the effect of a 

*G 2 single event upset in a fault tolerant processing 

ffl 3 system including at least three processor groups, 

G 4 each processor group including a CPU, an input, an 

1^1 5 output, and a support logic device, said method 

ft} 6 comprising the steps of: 

L_ 7 monitoring each of said plurality of 

yg 8 processor group outputs, - 

*h \ 

?Y 9 detecting an error in one of said processor 

s- - 

q 10 group outputs by comparing the outputs of each of 

N 4 11 said at three processor groups against each other; 

12 classifying each processor group as a 

13 majority processor group or minority processor group, 

14 said majority processor groups all having equal value 

15 outputs and comprising a majority of all processor 

16 groups, said minority processing groups each having 

17 an output different than each majority processing 

1 8 group ; 

19 when any processor group is classified as a 

20 minority processor group, storing state information 

21 for at least one of said processor groups classified 
2 2 as a majority processor group; 


simultaneously resetting each of said 
processor groups to restart at a state defined 
operating step; and 

restoring said stored state information to 
each of said processor groups. 

26. A method according to claim 25 
wherein, when no processor group is classified as a 
majority processor group, simultaneously resetting 
each of said processor groups and initializing each 
of said processor groups to restart at a state 
defined operating step. 


